GitHub Advisoryadvisory · crates.io

GHSA-7v2r-wxmg-mgvc HTTP Request smuggling in tiny_http

MEDIUM Published 2021-08-25 Modified 2023-06-13 Official page ↗
Aliases
CVE-2020-35884
Ecosystem
crates.io
Packages
tiny_http
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-444
Reviewed
2021-08-19

Affected packages

• crates.io tiny_http: < 0.8.0 → fixed in 0.8.0

Description

HTTP pipelining issues and request smuggling attacks are possible due to incorrect Transfer encoding header parsing. It is possible conduct HTTP request smuggling attacks (CL:TE/TE:TE) by sending invalid Transfer Encoding headers. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other than their own.

Related

Alias · CVE (1)

  • CVE-2020-35884 An issue was discovered in the tiny_http crate through 2020-06-16 for Rust. vulnerability

Weakness · CWE (1)

  • CWE-444 Inconsistent Interpretation of HTTP Requests weakness

References